This span of the alphabetical reference finishes AES key expansion, then re-lists the crypto bitmanip instructions — the same encodings the bitmanip chapter defines, gathered here because Zbkb/Zbkc/Zbkx are components of the Zk suites.
| Cryptographic role | Defined in | |
|---|---|---|
| aes64ks2 | Combines the aes64ks1i output with prior key words (the XOR chain) to emit the next round-key pair — the second half of AES-64 key expansion. | Zknd + Zkne (this chapter) |
| andn / orn / xnor | Masking and GF arithmetic helpers; the inverted-operand logicals cut instruction counts in bit-sliced ciphers. | Zbkb (u30) |
| brev8 | Bit-reverse within bytes — GHASH bit-reflection and endianness fixups for hash message schedules. | Zbkb (u30) |
| clmul / clmulh | Carry-less multiply — the GHASH/GCM core, kept in its own Zbkc extension for the multiplier cost. | Zbkc (u30) |
| pack / packh | Assemble wide values from byte/half lanes — bit-slicing and endianness marshalling. | Zbkb (u30) |
The remaining bitmanip-for-crypto instructions — packw, rev8,
rol/rolw/ror/rori/roriw/rorw (the SHA/ChaCha rotate
family), unzip/xnor/xperm8/xperm4/zip — continue into the
next reference span and are documented in full on
the bitmanip pages. Their cryptographic uses:
rotates drive SHA-2’s Σ/σ and every ARX cipher, xperm builds
constant-time SBoxes, zip/unzip emulate 64-bit permutations on RV32.
Hardware Designer Notes
Nothing new in silicon here beyond the ks pair (a rotate + SBox + Rcon ROM + XOR): the bitmanip instructions are literally the u30 datapath. The chapter’s value is the mapping from cryptographic primitive to instruction, which the reference tables make explicit.
Minimal Linux-boot hart MUST
- Implement aes64ks1i/ks2 as the RotWord/SubWord/Rcon + XOR-combine pair, sharing the AES SBox with the round instructions
- Route the shared bitmanip-crypto instructions through your existing Zbb/Zbc datapath — no separate crypto copies
MAY simplify / trap-and-emulate
- Handle the AES-256 special key-schedule case (the immediate value that suppresses Rcon and RotWord) in aes64ks1i decode
Check yourself — key schedule & bitmanip crypto
1.aes64ks1i takes a round-number immediate. What does it compute?
2.Why do the crypto bitmanip instructions (rol, ror, andn, pack, brev8, clmul, xperm…) appear in THIS chapter when they're defined in the bitmanip chapter?